CVE-2023-49812

2023-12-1921:15:09

CWE-639

[email protected]

web.nvd.nist.gov

authorization bypass

wp photo album

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

37.2%

JSON

Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.

Affected configurations

Nvd

Node

wppawp_photo_album_plusRange≤8.5.02.005wordpress

VendorProductVersionCPE
wppawp_photo_album_plus*cpe:2.3:a:wppa:wp_photo_album_plus:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wppa	wp_photo_album_plus	*	cpe:2.3:a:wppa:wp_photo_album_plus::::::wordpress::*

References

patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-insecure-direct-object-references-idor-vulnerability?_s_id=cve